CVE-2020-11637: Automation Runtime TFTP Service DoS Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-15 · updated 2026-06-17
Weakness: CWE-401

Description

A memory leak in the TFTP service in B&R Automation Runtime versions <N4.26, <N4.34, <F4.45, <E4.53, <D4.63, <A4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition.

Affected products

B&R Industrial Automation Automation Runtime: through 4.10; from 4.20 before n4.26; from 4.40 before f4.45; from 4.50 before e4.53; from 4.60 before d4.63; from 4.70 before a4.73 — fixed in a4.73, d4.63, e4.53, f4.45, n4.26, n4.34

How to fix

Upgrade to a fixed version: B&R Industrial Automation Automation Runtime a4.73, d4.63, e4.53, f4.45. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-11637 or the next vulnerability affects your stack